You manage an Azure environment containing a virtual network named VNet1. VNet1 has two subnets: SubnetA and SubnetB. SubnetA has the Microsoft.Storage service endpoint enabled. You have an Azure Storage Account named storage1. You need to implement a network security configuration for storage1 to meet the following requirements:
1. Virtual machines in SubnetA must be able to access storage1 over the public endpoint of the storage account using the Azure backbone network.
2. Virtual machines in SubnetB must be able to access storage1 using a private IP address within VNet1.
3. Azure Backup must be able to back up the data stored in storage1 successfully.
Which three actions should you perform? (Choose three.)
- On the firewall settings of storage1, configure the public network access to be enabled from selected virtual networks and IP addresses, and add SubnetA.Cevap
- Create a private endpoint for storage1 in SubnetB.Cevap
- Configure the firewall of storage1 to allow trusted Microsoft services to access this storage account.Cevap
- DEnable the Microsoft.Storage service endpoint on SubnetB, and add SubnetB to the virtual network rules of storage1.
- EAssign the Storage Blob Data Contributor RBAC role to the Azure Backup service principal at the subscription level.
Cevap
To meet the requirements, you must allow access from SubnetA by adding it to the allowed virtual networks on the storage firewall, create a private endpoint for the storage account in SubnetB to provide a private IP address, and enable the 'Allow trusted Microsoft services to access this storage account' bypass option to allow Azure Backup to function.
To satisfy all requirements: 1. The firewall of the storage account must be configured to allow access from selected networks, specifically adding the subnet that has the service endpoint enabled. 2. A private endpoint must be created in the subnet without the service endpoint, which projects a private IP address into that subnet for secure private access. 3. The exception to allow trusted Microsoft services to access the storage account must be enabled to ensure Azure Backup can access the account despite firewall restrictions.
Adım Adım Çözüm
Anahtar Kavram
Azure Storage firewall rules, Service Endpoints, and Private Endpoints
Alternatif Yöntem
Instead of using a service endpoint for SubnetA, you could also configure a private endpoint for SubnetA, but this does not satisfy the specific requirement to access the storage account over its public endpoint using the Azure backbone network.
Tahmini Süre:2m 0s